BunkerWeb CVE-2026-61718

BunkerWeb is an open-source next-generation WAF whose web UI uses Biscuit tokens for role-based authorization, enforced by a middleware class (BiscuitMiddleware in src/ui/app/models/biscuit.py). This middleware maintains a static list of URL prefixes that bypass Biscuit evaluation - historically intended for genuinely static assets such as CSS, images, fonts, and JavaScript. The /cache/ prefix was erroneously included in this bypass list, meaning requests to routes under /cache/ in src/ui/app/routes/cache.py were only validated by Flask's @login_required (authentication check), never by the Biscuit operation policy that maps HTTP verbs to read or write roles. CWE-285 (Improper Authorization) captures this precisely: the system correctly authenticated users but failed to verify whether the authenticated identity held sufficient privilege for the requested write operation. The fix (commit 685ccbbe) removes /cache/ from the bypass list, introduces a STATIC_PATH_PREFIXES constant for the remaining legitimate bypasses, and routes all /cache/ requests through the standard GET→read / POST→write Biscuit policy evaluation. The same patch also addressed Datalog injection risks in Biscuit fact construction, session fixation, open redirect, and hostname validation - indicating a broader security audit accompanied this fix.